How to leverage SMS text marketing to increase return visits

Welcome to the Purple technical briefing. Today we are covering how to use SMS text marketing to increase return visits to your venue. Whether you run a hotel chain, a retail estate, a stadium, or a transport hub, the principle is the same. You have a physical space. People visit it. You want them to come back. SMS is one of the most direct and measurable tools available to achieve that. This briefing is structured in five parts. We will cover the data capture architecture, the campaign design, compliance requirements, common failure modes, and how to measure return on investment. By the end, you will have a clear picture of what needs to change in your current setup and why. Let us start with the fundamentals. SMS marketing has a 98% open rate. Compare that to email, which averages around 20%. When you send an SMS, it gets read. 90% of messages are read within three minutes of delivery. That immediacy is the core value proposition. But there is a catch. To send an SMS, you need a verified phone number. And to send a marketing SMS, you need explicit consent from the recipient. Most venue operators are sitting on large email databases but have very few verified mobile numbers. That gap is the problem we are solving today. The most effective way to build a verified, consented SMS database is through your Guest WiFi network. When a visitor connects to the WiFi, they pass through a captive portal. That portal is your data ingestion point. Most venues use it to collect email addresses. We want to upgrade that process to collect verified mobile numbers instead, or in addition to email. Here is exactly how the technical flow works. The visitor's device associates with the Guest WiFi access point. The network controller - whether that is Cisco Meraki, HPE Aruba, Ruckus, Juniper Mist, or another supported platform - intercepts the HTTP traffic and redirects the browser to the captive portal. The visitor sees a branded login page. They enter their mobile number. The Purple Engage platform immediately sends a one-time password to that number via SMS. The visitor enters the OTP into the portal, reviews the terms and conditions, and actively checks an unchecked opt-in box to confirm they are happy to receive marketing messages. They then tap submit, and the RADIUS server authenticates the session and grants internet access. That OTP step is critical, and I want to spend a moment on why. Without it, visitors can enter any phone number to get online. They will often enter a fake number, a friend's number, or a number with a typo. Your database fills up with unverified data. When you send campaigns, the messages bounce. High bounce rates trigger carrier filtering, which means future messages get blocked. The OTP step eliminates that problem entirely. Every number in your database is verified as active and belonging to the person who connected. Now let us talk about the MAC address. When a device connects to the access point, the hardware records the device's MAC address - its unique network identifier. Purple ties the verified phone number to that MAC address. Every time that same device returns to the venue and connects to the WiFi, the platform records the visit. This is the mechanism that enables closed-loop attribution. You send an SMS campaign, and then you can check whether those specific devices returned to the venue. You are measuring actual footfall, not just digital engagement. Let me walk through the infrastructure integration in more detail. Purple operates as a cloud overlay on top of your existing hardware. You do not need to replace your access points or your network controllers. You configure the wireless LAN controller to point authentication requests to Purple's RADIUS servers. You set up the walled garden to allow traffic to the captive portal and the SMS gateway domains before authentication. Purple handles the rest. The platform integrates with Cisco Meraki, HPE Aruba, Ruckus, Juniper Mist, Ubiquiti UniFi, Cambium, Extreme, and Fortinet. If you are running a mixed estate with multiple hardware vendors across different sites, Purple's hardware-agnostic architecture means you can manage all of them from a single platform. That is particularly relevant for retail chains and hospitality groups with large, diverse property portfolios. Now let us get into the campaign architecture. The most effective SMS campaigns for driving return visits are not bulk broadcasts. They are behavioural triggers. A bulk broadcast to your entire database once a month will generate opt-outs. A targeted message triggered by a specific visitor behaviour will generate return visits. The difference in performance is significant. Here are the three trigger types that work consistently across hospitality, retail, and transport environments. The first is the lapsed visitor campaign. You define a threshold - typically 30 days - and if a MAC address has not been detected by your access points within that period, the platform automatically sends an SMS. The message should be direct. Your brand name, a specific offer, a tracked link, and opt-out instructions. Something like: Premier Inn: We have not seen you for a while. Book your next stay this week and get 15% off. Use code RETURN15. Reply STOP to opt out. That message intercepts the visitor before a competitor does. The second trigger is the welcome message. This fires 15 minutes after a first-time visitor connects. You want to give them time to settle in before the message arrives. The goal is to provide immediate value and begin the relationship. A discount code for their current visit works well. It drives in-visit spend and creates a positive first impression. The third trigger is the milestone message. This fires on the visitor's birthday, or after their fifth visit, or after their tenth visit. The exact trigger depends on your loyalty programme structure. The point is to signal that you recognise the visitor as an individual and that you value their continued business. These messages consistently outperform generic promotions in terms of engagement and redemption rates. When you write the message copy, remember you have 160 characters. That is one SMS. Going over 160 characters splits the message into two, which doubles your cost and can look unprofessional on some handsets. Keep it tight. Brand name first. Offer second. Call to action third. Opt-out last. Every element earns its place. Now, compliance. I want to be direct about this. SMS marketing is heavily regulated, and the consequences of getting it wrong are serious. Under GDPR in Europe, and the TCPA in the United States, you must have explicit consent before sending any marketing message. Explicit consent means the visitor made a deliberate, informed choice to opt in. A pre-ticked box on the captive portal does not constitute explicit consent under GDPR. The box must be unchecked. The visitor must tick it themselves. The purpose must be clearly stated. The frequency must be indicated. And the opt-out mechanism must be described. If your current portal has a pre-ticked box, that is a compliance risk you need to address before your next campaign. Every SMS message must include clear opt-out instructions. Typically this is: Reply STOP to opt out. When a visitor replies STOP, the platform must process that request automatically and update the visitor's profile to prevent any further marketing messages. This must happen without manual intervention. You must also document and enforce a data retention policy. If a visitor has not connected to your network or engaged with your messages for a defined period - typically 24 months - you should anonymise or delete their personal data. This is both a legal requirement and good data hygiene. Stale data degrades your deliverability metrics and inflates your database costs. One more compliance point that often gets overlooked. You cannot use an existing email consent to send SMS messages. They are separate channels requiring separate consent. If you have 50,000 email subscribers and you want to add SMS, you need to run a fresh opt-in campaign specifically for SMS. Let me cover the three most common failure modes I see when venues deploy SMS marketing for the first time. The first is high bounce rates. This is almost always caused by unverified data. The venue has not implemented OTP authentication on the captive portal, so visitors enter fake or incorrect numbers. The messages bounce. High bounce rates signal to mobile carriers that you are sending to bad data, which damages your sender reputation and can result in your messages being filtered. The fix is straightforward: implement SMS OTP authentication on the captive portal. The second failure mode is carrier filtering. This happens when a venue sends a large bulk broadcast without registering their Sender ID. Mobile carriers see a sudden spike of thousands of messages from an unregistered source and flag it as spam. The messages are blocked or throttled. The campaign fails. To avoid this, register your alphanumeric Sender ID with the relevant carriers before you launch. Use rate limiting to stagger large campaigns over several hours rather than sending everything simultaneously. The third failure mode is low opt-in rates. If visitors are connecting to the WiFi but not opting in to marketing, the value exchange is not compelling enough. Review the captive portal design. Is the benefit of opting in clearly stated? Is there an immediate incentive? We typically see opt-in rates of 30 to 50 percent when the value exchange is clear and the portal design is clean. Now for the rapid-fire questions I hear most often. Can I use existing email data to build my SMS list? No. Separate consent is required for each channel. What is a realistic opt-in rate? 30 to 50 percent with a clear incentive. How frequently should I send? Two to four messages per month maximum. Beyond that, opt-out rates climb sharply. How do I prove ROI? Use closed-loop attribution. Send the campaign. Then measure how many of those specific MAC addresses return to the venue within seven days. That is footfall, not just clicks. To summarise the key points from today's briefing. Capture verified phone data through your Guest WiFi captive portal using SMS OTP authentication. Obtain explicit, unchecked consent at the point of capture. Deploy behavioural triggers rather than bulk broadcasts. Register your Sender ID and manage sending volume to avoid carrier filtering. Measure success by actual return visits using MAC address tracking. And ensure your data retention and opt-out processes are fully compliant with GDPR. Purple Engage connects all of these components into a single platform. It captures the data at login, automates the campaign triggers, processes opt-outs, and surfaces the return visit analytics. We have deployed this across more than 80,000 venues globally, from Premier Inn and Harrods to Manchester Airports Group and Avanti West Coast. If you want to see how this maps to your specific infrastructure, speak to the Purple team. Thank you for listening.